hosts/losurdo/wireguard/wg-extra.nix

   1 { inputs, hostName, ... }:
   2 let
   3   wgIface = "wg-extra";
   4   listenPort = 16843;
   5 in
   6 {
   7   networking.nftables.ruleset = ''
   8     table inet filter {
   9       chain input-net {
  10         udp dport ${toString listenPort} counter accept comment "${wgIface}"
  11       }
  12       chain input-extra {
  13         counter accept
  14       }
  15       chain input {
  16         iifname ${wgIface} jump input-extra
  17         iifname ${wgIface} log level warn prefix "input-extra: " counter drop
  18       }
  19       chain output-net {
  20       }
  21       chain output-extra {
  22         counter accept
  23       }
  24       chain output {
  25         oifname ${wgIface} jump output-extra
  26         oifname ${wgIface} log level warn prefix "output-extra: " counter drop
  27       }
  28       chain forward {
  29         # forward
  30         iifname ${wgIface} counter accept
  31       }
  32     }
  33   '';
  34   #boot.kernel.sysctl."net.ipv4.ip_forward" = 1;
  35   systemd.services."wireguard-${wgIface}".serviceConfig.LoadCredentialEncrypted = [
  36     "privateKey:${./. + "/${wgIface}/privateKey.cred"}"
  37   ];
  38   networking.wireguard.interfaces.${wgIface} = {
  39     # publicKey: 1Iyq96rPHfyrt4B31NqKLgWzlglkMAWjA41aF279gjM=
  40     privateKeyFile = "$CREDENTIALS_DIRECTORY/privateKey";
  41     ips = [ "192.168.43.1/32" ];
  42     inherit listenPort;
  43     socketNamespace = null;
  44     /*
  45       interfaceNamespace = "extra";
  46       preSetup = ''
  47       ${pkgs.iproute}/bin/ip netns add extra
  48       '';
  49     */
  50     peers = [
  51       {
  52         # julm-laptop
  53         publicKey = "Ul1+GINJ/eXy7MhUQLB6wXboLUfKW32nwHd/IAGtwSk=";
  54         allowedIPs = [ "192.168.43.2/32" ];
  55       }
  56       {
  57         # julm-mobile
  58         publicKey = "7hdI8aInfxFG0Ua1jHMDmx1RezI1q1PObFx6Kp2g5iI=";
  59         allowedIPs = [ "192.168.43.3/32" ];
  60       }
  61     ];
  62   };
  63 }